I don't think that answers his Q. On my boxes if you put a password in lilo it will NOT boot on it's own after a power failure. Frank, what you should probably do is remove the "prompt" line from /etc/lilo.conf. That way it will boot straight into Linux without asking anything - much the same as windows boots straight into windows without asking. That way there will never be a prompt for user input, so no malicious users will have a chance to type anything in(of course neither will you). JW At 07:24 PM 9/26/2000 +0200, you wrote:
Hi!
just stepped on this option to type "linux init=/bin/sh" at the boot prompt, which gives me a root shell. For me, that's really a security problem: We have some computers here which we cannot protect with boot-passwords because they have to come up automatically after a power drop. Can I somehow disable this possibility of passing an alternative init-parameter for my SuSE 6.4?
this is from SuSE /etc/lilo.conf:
# Start LILO global Section # If you want to prevent console users to boot with init=/bin/bash, # restrict usage of boot params by setting a passwd and using the option # restricted. password=password restricted
good luck! Yuri.
--------------------------------------------------------------------- To unsubscribe, e-mail: suse-security-unsubscribe@suse.com For additional commands, e-mail: suse-security-help@suse.com
Hi!
I don't think that answers his Q. On my boxes if you put a password in lilo it will NOT boot on it's own after a power failure.
It does work. Even with a powerfailure. I have this exact configuration on my machine. LILO boots without asking for a password. It only asks for a password when you type additional bootparameters.
Frank, what you should probably do is remove the "prompt" line from /etc/lilo.conf. That way it will boot straight into Linux without asking anything - much the same as windows boots straight into windows without asking. That way there will never be a prompt for user input, so no malicious users will have a chance to type anything in(of course neither will you).
That does not help. Pressing the <ctrl>-key while LILO starts will give you a bootprompt even when no bootprompt has been enabled in LILO. Cheers! Yuri.
At 07:24 PM 9/26/2000 +0200, you wrote:
Hi!
just stepped on this option to type "linux init=/bin/sh" at the boot prompt, which gives me a root shell. For me, that's really a security problem: We have some computers here which we cannot protect with boot-passwords because they have to come up automatically after a power drop. Can I somehow disable this possibility of passing an alternative init-parameter for my SuSE 6.4?
this is from SuSE /etc/lilo.conf:
# Start LILO global Section # If you want to prevent console users to boot with init=/bin/bash, # restrict usage of boot params by setting a passwd and using the option # restricted. password=password restricted
good luck! Yuri.
--------------------------------------------------------------------- To unsubscribe, e-mail: suse-security-unsubscribe@suse.com For additional commands, e-mail: suse-security-help@suse.com
--------------------------------------------------------------------- To unsubscribe, e-mail: suse-security-unsubscribe@suse.com For additional commands, e-mail: suse-security-help@suse.com
I don't think that answers his Q. On my boxes if you put a password in lilo it will NOT boot on it's own after a power failure.
That is probably due to the way you have your BIOS configured, or as mentioned below "prompt" without a "timeout" in Lilo's config.
Frank, what you should probably do is remove the "prompt" line from /etc/lilo.conf. That way it will boot straight into Linux without asking anything - much the same as windows boots straight into windows without asking. That way there will never be a prompt for user input, so no malicious users will have a chance to type anything in(of course neither will you).
HAHAHAHA. Uh, yes it can be made to prompt, just hold down control or shift-? as it boots and lilo will be a good little loader and wait fo input. http://www.securityportal.com/closet/closet20000906.html Goes into it in detail. Once again SecurityPortal has the answer ;)
JW
-Kurt
participants (3)
-
Kurt Seifried -
wilson＠claborn.net -
Yuri Robbers